Data Center Interconnect (DCI) solutions deploy Ethernet between data centers. A customer using a DCI solution often requires Quality of Service (QoS) for Ethernet frames sent between data centers. QoS concerns, among other things, the ability to apply different priority levels to different applications, users, or data flows in order to provide differing performance levels. QoS conventionally uses Virtual Local Area Network (VLAN) tags in the Ethernet frames. A Wide Area Network (WAN) may not securely connect data centers. The WAN may be exposed to malicious interference. Therefore, a tunneling protocol is generally used to encapsulate the Ethernet frames. Implementing a tunneling protocol requires encrypting the Ethernet frames. When performing this encryption with Media Access Control Security (MACsec) the VLAN tags necessary to implement QoS are encrypted. Conventionally, implementing QoS with the encrypted VLAN tags has been impossible. This inhibits using MACsec in many Ethernet provider networks.